bug#15671: Re: sequence of chmod and chown in unrestricted chown environment

[Vladimir Marek]

Hi,

> > But the chown
> > will be executed anyway just in a different sequence, so I don't see the
> > difference. 
> 
> The difference is that the setuid or setgid bits will be cleared
> by the chown, which means they'll be incorrect in the final version
> of the file.  If you execute the chmod after the chown, it doesn't
> matter that the chown clears those bits, since the chmod fixes that.

I'm sorry for returning so late to this topic.

The question was about chmod/chown sequence. At the moment it is

chown
chmod

In your last paragraph you said that it's because chown removes user-ID
and group-ID bits from file. But why would that matter, when (as I just
noticed) you check for those bits and abort with an error when the
source file has either UID or GID bit set.

The reason why I'm returning to this thread is that we found another way
to break the assumption that chmod will work after chown. First
possibility is the 'norstchown' mount option and second option is to
have user with 'file_chown_self' perm set. That can be again detected
and the chmod/chown sequence reversed in such case, but I still wonder,
what breaks if we switch it in all cases?

Thank you
-- 
        Vlad